Posted
by
msmash
on Monday August 07, 2017 @09:45AM
from the it-all-comes-down-to-this dept.

An anonymous reader shares a report: Australia's Commonwealth Bank has blamed a software update for a money laundering scam that saw criminals send over AU$70m (US$55m) offshore after depositing cash into automatic teller machines. News of the Bank's involvement in the laundering scam broke last week, when Australia's financial intelligence agency AUSTRAC announced that it had found over 53,500 occasions on which the Bank failed to submit reports on transactions over $10,000. All transactions of that value are reportable in Australia, as part of efforts to crimp the black economy, crime and funding of terrorism. The news was not a good look for the Bank (CBA), because most of the cash was deposited into accounts established with fake drivers licences. Worse still is that each failure of this type can attract a fine of AU$18m, leaving CBA open to a sanction that would kill it off. Today the bank has explained the reason for its failure: "a coding error" that saw the ATMs fail to create reports of $10,000+ transactions. The error was introduced in a May 2012 update designed to address other matters, but not repaired until September 2015.

Have you ever worked in a software company? QA gets the least resources, the least respect, and typically no veto rights whatsoever. When management decides that on date X the product ships then it ships. And when developers claim that QA is full of hooey then the developers are always considered to be right. That assumes that there is dedicated QA in the first place. There are plenty of places that ship as long as the compiler does not throw any hard errors.

How about ATMs that don't allow you to withdraw or deposit more than $10,000 in cash?
No, I'm guessing that they made transfers between accounts using the ATMs. but shouldn't the reporting be done at a centralized level?
e.g. ATM requests that a service transfers funds, the transfer service is used by all software to access the accounts (online, teller, ATM, phone), and THAT is responsible for logging $10k+ tr

Rust in my opinion, has not proven itself yet.Once the amateur programmers start using it to make shovel ware, junk programs. Then we will see how good it really is. Right now most of the Rust developers (Not all) are good at their craft and already write careful code.

Once it matures a bit, it will get the immature developers on it, meaning they will stumble on crazy hacky ways to get things done. Making all the variables mutable just because it will be easier than having compile errors.

With modern OS's (Memory Address randomization, have data and Executable data in different areas of the memory ) the types of bugs that Rust fixes by default will prevent a bunch of system crashes vs using low level hacking methods to control the system.

Besides the developers who are good at fixing the low level security problems are often not the same people who are good at fixing logic errors.

I find most bugs comes from management pushing the get the product done quickly. and forcing using the prototype p

> Would using a provably safe language like Rust have prevented these bugs?

A programmer somewhere could have been bribed to do this deliberately. In that case, it doesn't matter whether it's COBOL/FORTRAN/C/C++/PYTHON/RUST/whatever. This was not a buffer overflow, or a null pointer. The program was WAD (Working As Designed). Someone on the design team accidentally or deliberately did this.

Regression testing, for complicated applications can still miss a lot of bugs. To do a full regression test, it could put the company at a full stand still. I remember the boss asking to process a sample of data with a 5% margin of error. We calculated the sample size, and we needed to process 100,000 records... Giving them that number, no one wanted to do it. So that fell by the wayside.

The $10K reporting requirement has been around for a long time. The bug is that they *stopped* reporting the transactions. Previous to this software update, the transactions were being reported, so the reporting was either deliberately stopped (possible, but unlikely), or the trigger wasn't pulled because some flag wasn't set because Total_A 10,000.00, even though it was.

How does a programmer turn off a process that should have "WARNING - THIS IS REQUIRED BY LAW" written all over the comments?

You're correct of course, it can be expensive to test thoroughly. Depends on where your model and risk extend. The functional aspects of design? The maintenance of the software? Correct functioning of the ATM HW? Support procedures? Escalation? Audit? Independent verification? Monitoring of operational performance of it and other applications that provide inputs or consume outputs, etc...the division, governance, the business?

My point is that especially in a fashionable Dev Ops world, the 'system' includ

The reporting is not for a standard ATM, these are for deposit ATM's placed around the world where deposits can be very large and from the sounds of it when a large deposit is received they are supposed to trigger a report (larger than $10,000 AUD). the coding error gives them an excuse for the majority however there is also a chunk of them (around 100 or so) where they also failed to monitor and report known suspicious accounts for which they have no excuse for. In theory total fines could be as much as $1

Not sure what you mean by standard ATM, here virtually every machine accepts deposits barring the shady ones in bars. I stand by my point, reporting standards aren't only for deposits, they are also for transfers, cheques, etc.

these ATM's accepted and counted cash which could be placed into accounts anonymously. ATM's have long been able to accept deposits but "most" required you to use a card or access your account first and then would provide a deposit envelope, the net effect was really the deposit was processed much later when a bank staffer checked the deposit. with the IDM ATM's the deposit is instant and anonymous so criminals could then immediately transfer the funds seconds are the cash is deposited making them highly at

Again, how is that different precisely? Whether a machine or a person counts the bills the result is still sent to a central authority which can easily do the reporting or you can implement it in 47 different places.

Money laundering laws remind me of stuff like DRM, where it's primarily known for being a pain in the ass for completely innocent people, and it's assumed that crooks already know how to get around it anyway and are therefore not as inconvenienced or violated as everyone else.

Any time a money laundering law comes into play, it's very likely that it's just making things harder for (or compromising the privacy of) a non-criminal. Ergo, the laws have little legitimacy and no person worries if they're circumven

The $10000 reporting limit is transparent to the end user unless the transaction is made in cash (and not, it seems, a deposit through one of these machines) or triggers the "suspicious activity" criteria (e.g. repeated $9000+ deposits). I have moved close to $30000 electronically to other parties, in both AUD and USD through a forex service, in past weeks for a trip to Patagonia/Antarctica: not a piece of paper in sight.
The machines in question are for deposits, primarily for out-of-bank-hours busines

Firstly I love to kick the crap out of Aussie banks as much as the next person. It is a national past time down her under the rest of the world.The Aussie banking system is regulated up the wazoo,with APRA and ASIC constantly moving the regulations around to protect people from the perceived 'predatory' ways of the 'Big' Banks, being NAB, Westpac, ANZ and CBA in recent time. Now firstly these banks make obscene amounts of profits, and in the past have made some monumental screw ups/crap decisions, as hav

Absolutely agree with this comment. But with any large organisation, it is a lumbering beast, and when asked to run it tends to fall over. Structured change is better than constant change, and with many sections of government 'decisions' it tends to be reactive rather than tempered pro-activity.

I worked most of career in.au, the last 10 years as a contract Information Architect. All industries NGO,.gov, Big 4s, SMEs, Energy etc are depressingly not self aware. Like a complicated soup, they struggle with the laws of thermodynamics, Chinese whispers and too many chefs.

It's depressing as a stakeholder (ie citizen, customer, investor etc) to observe. OTH, it's been a lucrative career and I am enjoying a multi year sabbatical in Europe, studying Art History and (barely) managing a porn startup.